Attribute-based Access Control (ABAC) is an access control model which uses attributes and policies to express access control logic. It extends the capabilities of RBAC (role-based access control).

Attribute-based Access Control (ABAC) is an access control model which uses attributes and policies to express access control logic. It extends the capabilities of (role-based access control).

ABAC can be broken down into:

  • Externalized authorization: decoupled from the business logic
  • Centralized authorization: Authorization logic moved into a single point of management
  • Policy-driven authorization: Authorization logic expressed as configurable policies rather than code
  • Attribute-based access control: Policies use attributes as their building blocks

Much like RBAC was standardized by NIST in 1992, ABAC is also being standardized by NIST. The project page can be found here.

The main implementation of ABAC today is XACML, the eXtensible Access Control Markup Language. XACML is defined by OASIS.

history | excerpt history